{"id":869,"date":"2025-01-01T18:50:58","date_gmt":"2025-01-01T18:50:58","guid":{"rendered":"https:\/\/virtualall.sk\/?p=869"},"modified":"2026-09-11T14:45:23","modified_gmt":"2026-09-11T14:45:23","slug":"kompletny-sprievodca-zabezpecenim-windows-servera-s-veeam-automatizacia-podla-cis-standardov","status":"publish","type":"post","link":"https:\/\/virtualall.sk\/en\/2025\/01\/kompletny-sprievodca-zabezpecenim-windows-servera-s-veeam-automatizacia-podla-cis-standardov\/","title":{"rendered":"Windows Server Security with Veeam"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">V dne\u0161nej digit\u00e1lnej \u00e9re, kde kybernetick\u00e9 hrozby neust\u00e1le narastaj\u00fa, je zabezpe\u010denie IT infra\u0161trukt\u00fary k\u013e\u00fa\u010dov\u00e9 pre ochranu citliv\u00fdch \u00fadajov a zachovanie kontinuity podnikania. Pre organiz\u00e1cie vyu\u017e\u00edvaj\u00face rie\u0161enia Veeam na z\u00e1lohovanie a obnovu d\u00e1t je nevyhnutn\u00e9 zabezpe\u010di\u0165, aby ich Windows servery boli spr\u00e1vne nakonfigurovan\u00e9 a odoln\u00e9 vo\u010di potenci\u00e1lnym \u00fatokom. Na tento \u00fa\u010del bol vyvinut\u00fd &#8220;Veeam Windows Hardening Script&#8221;, ktor\u00fd umo\u017e\u0148uje automatizovan\u00e9 spevnenie syst\u00e9mu pod\u013ea odpor\u00fa\u010dan\u00ed Centra pre internetov\u00fa bezpe\u010dnos\u0165 (CIS).<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u010co je Veeam Windows Hardening Script?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Veeam Windows Hardening Script je PowerShell skript navrhnut\u00fd na automatiz\u00e1ciu procesu spevnenia (hardeningu) Windows Servera 2022, na ktorom je nain\u0161talovan\u00fd Veeam Backup &amp; Replication alebo Veeam Enterprise Manager. Skript implementuje odpor\u00fa\u010dania z CIS Benchmarku pre Windows Server 2022, \u010d\u00edm zabezpe\u010duje, \u017ee syst\u00e9m sp\u013a\u0148a osved\u010den\u00e9 postupy v oblasti bezpe\u010dnosti.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Pou\u017eitie pr\u00edkazu <code>Set-ExecutionPolicy<\/code> pri Veeam Windows Hardening Skripte<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Ke\u010f\u017ee skript vyu\u017e\u00edva PowerShell, m\u00f4\u017eete sa stretn\u00fa\u0165 s potrebou spusti\u0165 nepodp\u00edsan\u00e9 alebo obmedzen\u00e9 skripty na syst\u00e9me. Na tento \u00fa\u010del sa \u010dasto vyu\u017e\u00edva pr\u00edkaz:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass<\/code><\/pre>\n\n\n\n<h4 class=\"wp-block-heading\"><strong>\u010co tento pr\u00edkaz rob\u00ed?<\/strong><\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Tento pr\u00edkaz do\u010dasne nastav\u00ed z\u00e1sady sp\u00fa\u0161\u0165ania PowerShell skriptov (Execution Policy) na hodnotu <code>Bypass<\/code>, ktor\u00e1 deaktivuje ak\u00e9ko\u013evek obmedzenia pre aktu\u00e1lny PowerShell proces. To umo\u017en\u00ed skriptom sp\u00fa\u0161\u0165a\u0165 sa bez oh\u013eadu na existuj\u00face z\u00e1sady zabezpe\u010denia, ktor\u00e9 m\u00f4\u017eu blokova\u0165 ich vykonanie. Veeam Windows Hardening Script m\u00f4\u017ee obsahova\u0165 konfigur\u00e1cie a moduly, ktor\u00e9 by predvolen\u00e1 z\u00e1sada <code>Restricted<\/code> alebo <code>RemoteSigned<\/code> blokovala. Pou\u017eitie <code>Bypass<\/code> z\u00e1sady zaru\u010duje, \u017ee skript sa spust\u00ed bez prek\u00e1\u017eok, \u010d\u00edm ur\u00fdch\u013euje hardening procesu. T\u00e1to zmena je v\u0161ak do\u010dasn\u00e1 a po ukon\u010den\u00ed PowerShell rel\u00e1cie sa z\u00e1sady vr\u00e1tia na p\u00f4vodn\u00e9 nastavenie.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\"><strong>Stiahnutie skriptu<\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Script z ofici\u00e1lneho \u00falo\u017eiska GitHub:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Download<\/strong>: <a href=\"https:\/\/github.com\/lukas-kl\/veeam-win-hardening-script\" target=\"_blank\" rel=\"noopener\">https:\/\/github.com\/lukas-kl\/veeam-win-hardening-script<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pre\u010do je hardening d\u00f4le\u017eit\u00fd?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u0160tandardn\u00e1 in\u0161tal\u00e1cia Windows Servera obsahuje mno\u017estvo predvolen\u00fdch nastaven\u00ed, ktor\u00e9 m\u00f4\u017eu predstavova\u0165 bezpe\u010dnostn\u00e9 rizik\u00e1. Tieto zranite\u013enosti m\u00f4\u017eu by\u0165 zneu\u017eit\u00e9 \u00fato\u010dn\u00edkmi na neopr\u00e1vnen\u00fd pr\u00edstup k syst\u00e9mu, kr\u00e1de\u017e d\u00e1t alebo naru\u0161enie prev\u00e1dzky. Implement\u00e1ciou hardeningu sa minimalizuje povrch \u00fatoku, \u010d\u00edm sa zvy\u0161uje odolnos\u0165 syst\u00e9mu vo\u010di potenci\u00e1lnym hrozb\u00e1m.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Hlavn\u00e9 funkcie skriptu<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Automatizovan\u00e9 nastavenia bezpe\u010dnostn\u00fdch polit\u00edk<\/strong>: Skript aplikuje mno\u017estvo bezpe\u010dnostn\u00fdch nastaven\u00ed, ako je konfigur\u00e1cia auditovac\u00edch polit\u00edk, nastavenie hesiel a uzamknutie \u00fa\u010dtov po ne\u00faspe\u0161n\u00fdch pokusoch o prihl\u00e1senie.<\/li>\n\n\n\n<li><strong>Deaktiv\u00e1cia nepotrebn\u00fdch slu\u017eieb<\/strong>: Vypnutie slu\u017eieb, ktor\u00e9 nie s\u00fa nevyhnutn\u00e9 pre prev\u00e1dzku Veeam, \u010d\u00edm sa zni\u017euje riziko zneu\u017eitia t\u00fdchto slu\u017eieb \u00fato\u010dn\u00edkmi.<\/li>\n\n\n\n<li><strong>Nastavenie firewallu<\/strong>: Konfigur\u00e1cia pravidiel firewallu na blokovanie neopr\u00e1vnen\u00e9ho pr\u00edstupu a povolenie len potrebn\u00fdch portov pre Veeam slu\u017eby.<\/li>\n\n\n\n<li><strong>Ochrana proti malv\u00e9ru<\/strong>: Implement\u00e1cia nastaven\u00ed na zv\u00fd\u0161enie ochrany syst\u00e9mu pred \u0161kodliv\u00fdm softv\u00e9rom, vr\u00e1tane nastaven\u00ed Windows Defendera.<\/li>\n\n\n\n<li><strong>Audit a monitorovanie<\/strong>: Nastavenie auditovac\u00edch polit\u00edk na sledovanie a zaznamen\u00e1vanie d\u00f4le\u017eit\u00fdch udalost\u00ed v syst\u00e9me, \u010do umo\u017e\u0148uje r\u00fdchlu detekciu a reakciu na bezpe\u010dnostn\u00e9 incidenty.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Ako skript funguje?<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Skript je navrhnut\u00fd tak, aby bol interakt\u00edvny a pou\u017e\u00edvate\u013ea krok za krokom previedol procesom hardeningu. Po spusten\u00ed skriptu s administr\u00e1torsk\u00fdmi pr\u00e1vami na \u010derstvo nain\u0161talovanom Windows Serveri 2022, ktor\u00fd nie je \u010dlenom dom\u00e9ny, skript postupne aplikuje jednotliv\u00e9 bezpe\u010dnostn\u00e9 nastavenia pod\u013ea CIS Benchmarku. Po dokon\u010den\u00ed procesu sa server re\u0161tartuje, aby sa zabezpe\u010dilo spr\u00e1vne uplatnenie v\u0161etk\u00fdch zmien.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Zabezpe\u010denie hesiel<\/strong>: Nastavuje minim\u00e1lnu d\u013a\u017eku hesla, vy\u017eaduje komplexnos\u0165 a obmedzuje op\u00e4tovn\u00e9 pou\u017eitie star\u0161\u00edch hesiel.<\/li>\n\n\n\n<li><strong>Politiky uzamknutia \u00fa\u010dtu<\/strong>: Nastavuje maxim\u00e1lny po\u010det ne\u00faspe\u0161n\u00fdch pokusov o prihl\u00e1senie a dobu trvania uzamknutia \u00fa\u010dtu.<\/li>\n\n\n\n<li><strong>Auditovacie pravidl\u00e1<\/strong>: Aktivuje podrobn\u00e9 sledovanie a zaznamen\u00e1vanie udalost\u00ed, ako s\u00fa zmeny v syst\u00e9me a pokusy o neopr\u00e1vnen\u00fd pr\u00edstup.<\/li>\n\n\n\n<li><strong>Nastavenie firewallu<\/strong>: Upravuje pravidl\u00e1 firewallu na povolenie len potrebn\u00fdch slu\u017eieb a portov.<\/li>\n\n\n\n<li><strong>Deaktiv\u00e1cia nepotrebn\u00fdch slu\u017eieb<\/strong>: Vyp\u00edna slu\u017eby, ktor\u00e9 nie s\u00fa kritick\u00e9 pre prev\u00e1dzku syst\u00e9mu, \u010d\u00edm zni\u017euje povrch \u00fatoku.<\/li>\n\n\n\n<li><strong>Ochrana pred malv\u00e9rom<\/strong>: Konfiguruje Windows Defender na optim\u00e1lnu ochranu vr\u00e1tane skenovania a blokovania \u0161kodliv\u00e9ho softv\u00e9ru.<\/li>\n\n\n\n<li><strong>Nastavenia vzdialen\u00e9ho pr\u00edstupu<\/strong>: Obmedzuje vzdialen\u00fd pr\u00edstup k syst\u00e9mu a zais\u0165uje, \u017ee je povolen\u00fd len pre administr\u00e1torov.<\/li>\n\n\n\n<li><strong>Zabezpe\u010denie sie\u0165ov\u00fdch protokolov<\/strong>: Deaktivuje nebezpe\u010dn\u00e9 protokoly a povol\u00ed len bezpe\u010dn\u00e9 \u0161ifrovan\u00e9 komunika\u010dn\u00e9 met\u00f3dy.<\/li>\n\n\n\n<li><strong>Upravenie registru<\/strong>: Aplikuje bezpe\u010dnostn\u00e9 zmeny v syst\u00e9movom registri pod\u013ea odpor\u00fa\u010dan\u00ed CIS Benchmarku.<\/li>\n\n\n\n<li><strong>Zabezpe\u010denie s\u00faborov\u00e9ho syst\u00e9mu<\/strong>: Nastavuje spr\u00e1vne opr\u00e1vnenia pre kritick\u00e9 syst\u00e9mov\u00e9 s\u00fabory a adres\u00e1re.<\/li>\n\n\n\n<li><strong>Kontrola aktualiz\u00e1ci\u00ed<\/strong>: Konfiguruje syst\u00e9m na pravideln\u00e9 a automatick\u00e9 s\u0165ahovanie a in\u0161tal\u00e1ciu bezpe\u010dnostn\u00fdch aktualiz\u00e1ci\u00ed.<\/li>\n\n\n\n<li><strong>Odstr\u00e1nenie predvolen\u00fdch zdie\u013ean\u00ed<\/strong>: Zru\u0161\u00ed zdie\u013ean\u00e9 pr\u00edstupy k syst\u00e9mov\u00fdm jednotk\u00e1m, ktor\u00e9 m\u00f4\u017eu predstavova\u0165 riziko.<\/li>\n\n\n\n<li><strong>Logovanie pr\u00edstupov<\/strong>: Aktivuje protokolovanie v\u0161etk\u00fdch pr\u00edstupov k syst\u00e9mu a jeho kritick\u00fdm s\u00fa\u010dastiam.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Obmedzenia a odpor\u00fa\u010dania<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Prim\u00e1rne ur\u010denie<\/strong>: Skript je prim\u00e1rne ur\u010den\u00fd pre nov\u00e9 in\u0161tal\u00e1cie Windows Servera 2022 a nebol testovan\u00fd na star\u0161\u00edch verzi\u00e1ch syst\u00e9mu.<\/li>\n\n\n\n<li><strong>Ne\u010dlenstvo v dom\u00e9ne<\/strong>: Skript je navrhnut\u00fd pre servery, ktor\u00e9 nie s\u00fa \u010dlenmi dom\u00e9ny (standalone).<\/li>\n\n\n\n<li><strong>Testovanie v prostred\u00ed<\/strong>: Pred nasaden\u00edm skriptu v produk\u010dnom prostred\u00ed sa odpor\u00fa\u010da jeho otestovanie v testovacom prostred\u00ed, aby sa zabezpe\u010dila kompatibilita s existuj\u00facimi aplik\u00e1ciami a slu\u017ebami.<\/li>\n\n\n\n<li><strong>Z\u00e1lohovanie<\/strong>: Pred aplik\u00e1ciou skriptu je d\u00f4le\u017eit\u00e9 vytvori\u0165 z\u00e1lohu syst\u00e9mu, aby bolo mo\u017en\u00e9 v pr\u00edpade potreby obnovi\u0165 predch\u00e1dzaj\u00faci stav.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>V\u00fdhody pou\u017eitia skriptu<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Efektivita<\/strong>: Automatiz\u00e1cia procesu hardeningu \u0161etr\u00ed \u010das a zni\u017euje riziko \u013eudsk\u00fdch ch\u00fdb pri manu\u00e1lnom nastavovan\u00ed.<\/li>\n\n\n\n<li><strong>Konzistentnos\u0165<\/strong>: Skript zabezpe\u010duje jednotn\u00e9 uplatnenie bezpe\u010dnostn\u00fdch nastaven\u00ed pod\u013ea osved\u010den\u00fdch postupov, \u010do zvy\u0161uje celkov\u00fa bezpe\u010dnos\u0165 syst\u00e9mu.<\/li>\n\n\n\n<li><strong>Zn\u00ed\u017eenie rizika<\/strong>: Implement\u00e1ciou odpor\u00fa\u010dan\u00ed z CIS Benchmarku sa v\u00fdrazne zni\u017euje riziko \u00faspe\u0161n\u00e9ho \u00fatoku na syst\u00e9m.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Z\u00e1ver<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Veeam Windows Hardening Script predstavuje \u00fa\u010dinn\u00fd n\u00e1stroj na zv\u00fd\u0161enie bezpe\u010dnosti Windows Serverov vyu\u017e\u00edvan\u00fdch pre Veeam rie\u0161enia. Automatiz\u00e1ciou procesu hardeningu pod\u013ea odpor\u00fa\u010dan\u00ed CIS Benchmarku umo\u017e\u0148uje organiz\u00e1ci\u00e1m r\u00fdchlo a efekt\u00edvne zabezpe\u010di\u0165 svoje syst\u00e9my proti potenci\u00e1lnym hrozb\u00e1m. Napriek tomu je d\u00f4le\u017eit\u00e9 pristupova\u0165 k nasadeniu skriptu s opatrnos\u0165ou, d\u00f4kladne ho otestova\u0165 v testovacom prostred\u00ed a zabezpe\u010di\u0165, aby v\u0161etky aplik\u00e1cie a slu\u017eby fungovali spr\u00e1vne po aplik\u00e1cii zmien. T\u00fdmto sp\u00f4sobom m\u00f4\u017eu organiz<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">S\u00favisiace n\u00e1vody<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><a href=\"https:\/\/virtualall.sk\/2023\/12\/windows-server-rdp-brute-force-ochrana\/\">Windows Server RDP Brute Force ochrana<\/a><\/li>\n\n\n<li><a href=\"https:\/\/virtualall.sk\/2025\/03\/cis-benchmark\/\">CIS Benchmark<\/a><\/li>\n\n\n<li><a href=\"https:\/\/virtualall.sk\/2025\/07\/mssql-transakcne-logy-neviditelny-pozierac-diskoveho-priestoru\/\">MSSQL transak\u010dn\u00e9 logy &#8211; Spr\u00e1va diskov\u00e9ho priestoru<\/a><\/li>\n\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>V dne\u0161nej digit\u00e1lnej \u00e9re, kde kybernetick\u00e9 hrozby neust\u00e1le narastaj\u00fa, je zabezpe\u010denie IT infra\u0161trukt\u00fary k\u013e\u00fa\u010dov\u00e9 pre ochranu citliv\u00fdch \u00fadajov a zachovanie kontinuity podnikania. Pre organiz\u00e1cie vyu\u017e\u00edvaj\u00face rie\u0161enia Veeam na z\u00e1lohovanie a obnovu d\u00e1t je nevyhnutn\u00e9 zabezpe\u010di\u0165, aby ich Windows servery boli spr\u00e1vne nakonfigurovan\u00e9 a odoln\u00e9 vo\u010di potenci\u00e1lnym \u00fatokom. Na tento \u00fa\u010del bol vyvinut\u00fd &#8220;Veeam Windows Hardening&#8230;<\/p>\n<p class=\"more-link-wrap\"><a href=\"https:\/\/virtualall.sk\/en\/2025\/01\/kompletny-sprievodca-zabezpecenim-windows-servera-s-veeam-automatizacia-podla-cis-standardov\/\" class=\"more-link\">Read More<span class=\"screen-reader-text\"> &ldquo;Windows Server Security with Veeam&rdquo;<\/span> &raquo;<\/a><\/p>\n","protected":false},"author":1,"featured_media":870,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[84],"tags":[108,112],"class_list":["post-869","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-veeam-br","tag-backup","tag-bezpecnost"],"_links":{"self":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts\/869","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/comments?post=869"}],"version-history":[{"count":10,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts\/869\/revisions"}],"predecessor-version":[{"id":2438,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/posts\/869\/revisions\/2438"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/media\/870"}],"wp:attachment":[{"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/media?parent=869"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/categories?post=869"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualall.sk\/en\/wp-json\/wp\/v2\/tags?post=869"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}